Home/Glossary/Zoom OBF

What is Zoom OBF?

OBF, short for on-behalf-of, is Zoom's model for letting a bot join a meeting as an automated participant.

The bot acts on behalf of one user who has authorised your Zoom Marketplace app.

Each end user consents once.

After that your app can mint short-lived OBF tokens to join meetings for that user.

Tokens last about two hours each, one per SDK session.

Zoom has required OBF since 2 March 2026 for Meeting SDK bots joining meetings hosted outside the app's own account.

An OBF token is scoped to joining meetings as an automated participant.

Userconsents onceConnectionper zoom_user_idOBF tokenshort-livedBot joinson their behalf
One consent per user; every bot after that carries a token minted for that user.

Why OBF exists

Before OBF, bots joined with a Zoom Access Key.

Your integration fetched that per-user token through Zoom's API and handed it to the SDK.

OBF replaces it with a connection each end user authorises once, in Zoom's own consent screen.

Zoom can audit that connection, and either side can revoke it.

How the flow works on MeetStream

You register one Zoom OAuth app. Each end user then walks this path once.

1Step 1Authorise URLYour backend asksMeetStream2Step 2The userconsentsIn Zoom's ownscreen3Step 3Zoom redirectsTo your callback,with a code4Step 4Hand over thecodeYour backend, toMeetStream5Step 5ConnectionstoredAn identifiercomes back1Step 1Authorise URLYour backend asks MeetStream2Step 2The user consentsIn Zoom's own screen3Step 3Zoom redirectsTo your callback, with a code4Step 4Hand over the codeYour backend, to MeetStream5Step 5Connection storedAn identifier comes back
One consent per end user, then an identifier your create call names.

Creating a bot then names the user it is acting for:

Create a bot on behalf of a connected userjson
{
  "meeting_link": "https://zoom.us/j/123456789?pwd=…",
  "bot_name": "Notetaker",
  "zoom": { "use_zoom_obf": true,
            "zoom_oauth_connection_user_id": "<zoom_user_id>" }
}

Your app asks for two read scopes on the user profile and token.

You list and revoke connections through the same API.

MeetStream keeps all token material server side.

The Zoom integration page covers setup end to end.

The one value to double-check

The redirect URL matches byte for byte in three places.

WhereWhat it isSet byThe Zoom appThe registered redirect URLYour Marketplace appThe authorise callThe same URL, passed inYour backendThe connectioncallThe same URL againYour backendThe Zoom appWhat it is: The registered redirect URLSet by: Your Marketplace appThe authorise callWhat it is: The same URL, passed inSet by: Your backendThe connection callWhat it is: The same URL againSet by: Your backend
One value, written the same way in all three.

Matching it exactly is the one step worth double-checking.

Why does Zoom ask a user to reconnect?

A connection stays live while the user keeps their Zoom password and the app installed, and uses it inside 90 days.

Past any of those, the create call returns a disconnected-user response and one fresh consent restores it.

Host your callback on a deployed HTTPS endpoint so Zoom can reach it. The OBF implementation guide has the full sequence.

FAQ

Frequently asked questions

Is OBF mandatory?

For Meeting SDK bots joining meetings hosted outside your own Zoom account, yes, since 2 March 2026.

MeetStream handles the token exchange; you handle the one-time user consent.

What is the difference between OBF and ZAK?

A ZAK is a per-user credential your app fetches; OBF is a per-user consent the person grants, which Zoom can audit and either side can revoke.

Does the user have to be in the meeting?

Yes. Zoom issues OBF tokens only for participants who have authorised the app and are present in the meeting.

Can one Zoom app serve many customers?

Yes. Publish one app on the Marketplace. Each customer's users authorise it separately.

Put the vocabulary to work

One API to join, record, stream and transcribe meetings across Zoom, Google Meet and Microsoft Teams.